Commit 25d2e99
lib: harden kKeyOps lookup with null prototype
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #62877
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>1 parent eeae754 commit 25d2e99
2 files changed
Lines changed: 11 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -752,6 +752,7 @@ function getDigestSizeInBytes(name) { | |||
| 752 | 752 | } | |
| 753 | 753 | ||
| 754 | 754 | const kKeyOps = { | |
| 755 | + __proto__: null, | ||
| 755 | 756 | sign: 1, | |
| 756 | 757 | verify: 2, | |
| 757 | 758 | encrypt: 3, | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -9,6 +9,7 @@ const assert = require('assert'); | |||
| 9 | 9 | ||
| 10 | 10 | const { | |
| 11 | 11 | normalizeAlgorithm, | |
| 12 | + validateKeyOps, | ||
| 12 | 13 | } = require('internal/crypto/util'); | |
| 13 | 14 | ||
| 14 | 15 | { | |
@@ -49,3 +50,12 @@ const { | |||
| 49 | 50 | assert.strictEqual(normalized.name, 'ECDSA'); | |
| 50 | 51 | assert.strictEqual(nameReadCount, 1); | |
| 51 | 52 | } | |
| 53 | + | ||
| 54 | + { | ||
| 55 | + for (const ops of [ | ||
| 56 | + ['sign', 'toString', 'constructor'], | ||
| 57 | + ['sign', '__proto__', 'constructor'], | ||
| 58 | + ]) { | ||
| 59 | + validateKeyOps(ops); | ||
| 60 | + } | ||
| 61 | + } | ||
0 commit comments